75284ebee175529391f6858dd181132dfeee1c168ba549e4d560533a4dfc3728

Analysis

max time kernel
23s
max time network
35s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
29/11/2022, 07:43

Target

75284ebee175529391f6858dd181132dfeee1c168ba549e4d560533a4dfc3728.exe
Size

201KB
MD5

62f6052581f60f135ba54f80b874a654
SHA1

54425309996f907f7bd8efbcd61cb05bb283e0c1
SHA256

75284ebee175529391f6858dd181132dfeee1c168ba549e4d560533a4dfc3728
SHA512

91ebb9250209e4e5a450062cb4f790c96f05e1152dd9b350f53394265f95de50d11ac77cca73c3a98eda6d6082c4e52071af245d9f2bca2a5b8fbee7ee9f3027
SSDEEP

6144:Pkbgxx6+8gnSsoGSqAGFeM7DIlMzgQUOGAVMo:PkqxtnSssq5JIEgQ5Mo

Score

3^/10

Program crash 1 IoCs

pid	pid_target	Process	procid_target
1476	1772	WerFault.exe	16

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 1476	1772	75284ebee175529391f6858dd181132dfeee1c168ba549e4d560533a4dfc3728.exe	28
PID 1772 wrote to memory of 1476	1772	75284ebee175529391f6858dd181132dfeee1c168ba549e4d560533a4dfc3728.exe	28
PID 1772 wrote to memory of 1476	1772	75284ebee175529391f6858dd181132dfeee1c168ba549e4d560533a4dfc3728.exe	28
PID 1772 wrote to memory of 1476	1772	75284ebee175529391f6858dd181132dfeee1c168ba549e4d560533a4dfc3728.exe	28

C:\Users\Admin\AppData\Local\Temp\75284ebee175529391f6858dd181132dfeee1c168ba549e4d560533a4dfc3728.exe
"C:\Users\Admin\AppData\Local\Temp\75284ebee175529391f6858dd181132dfeee1c168ba549e4d560533a4dfc3728.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1772 -s 88
  2⤵
  - Program crash
  PID:1476